Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Vibecoding Pro

v1.0.0

Transform your AI coding workflow from "write and hope" to "iterate with precision." VibeCoding Pro implements the Generator-Evaluator dual-agent pattern (in...

0· 35·0 current·0 all-time
bymingyuan@zmy1006-sudo
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (dual-agent generator/evaluator using real browser interaction) align with included files (Evaluator prompts, iteration loop, calibration). However the SKILL.md and scripts assume Playwright/browser automation, a deployable artifact URL, and optional API/DB access; none of those runtime dependencies or credentials are declared in the manifest. This omission is disproportionate to the stated purpose (it should list required tooling and likely env vars).
Instruction Scope
SKILL.md and evaluator templates stay within scope: they instruct the Evaluator to read the SPEC, open the deployed URL or call API endpoints, interact like a user, take screenshots, and return structured JSON. There are no instructions to read local unrelated files or exfiltrate secrets. The templates do reference supplying auth headers/tokens for APIs, which is expected for API evaluation but not declared.
Install Mechanism
There is no install spec (instruction-only), and provided Python scripts are plain source — nothing is being downloaded or executed automatically. This is low install risk, but it does shift responsibility to the operator to install Playwright, browsers, and any other tools the templates assume.
Credentials
The manifest requests no env vars or credentials, but the evaluator templates and loop expect access to deployed URLs, API auth headers, and Playwright/browser tooling. The lack of declared required env vars (e.g., tokens for deployment, API auth, or cloud credentials) is a mismatch. The scripts include example hooks (sessions_spawn) that, when implemented, could require additional secrets or platform credentials — these should be explicitly listed before use.
Persistence & Privilege
The skill is not always-enabled and does not request elevated agent privileges. The package does not attempt to modify other skills or global configuration. The iteration scripts are templates that raise NotImplementedError and do not autonomously persist credentials or enable themselves.
What to consider before installing
This package is conceptually coherent for generator/evaluator workflows, but before installing or running anything: 1) Review and run a manual code audit of the two Python scripts — they contain NotImplementedError stubs and example calls (sessions_spawn) you must implement; do not run unreviewed code. 2) Expect to install Playwright and a browser (Chromium/Firefox) and possibly node/python toolchains — the skill does not declare these; install them in an isolated environment. 3) Prepare any deployment and API credentials you'll supply to the Evaluator/Generator and keep them minimal (use short-lived tokens where possible). The skill's templates accept auth headers and may require DB/API access — only provide credentials needed for the specific artifact under test. 4) When adapting run_generator/run_evaluator, avoid embedding secrets in code or returning them in evaluation JSON. 5) If you plan to wire this to a remote agent platform (sessions_spawn examples), verify and audit those platform calls to ensure they don't leak data. If you need this to run autonomously, add explicit declarations of required binaries and env vars and restrict tokens to least privilege. If any of these points are unclear or you want, I can enumerate exactly which env vars and binaries you should add to the manifest for a typical Playwright-based setup.

Like a lobster shell, security has layers — review code before you run it.

latestvk97500x4gtk96bfc0k97620eh183wb42

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments